Ateeq Khan

@AEMSecurity, @CyberCrimeNEWS - Father, Husband, Hacker - CVE-2016-0956, CVE-2013-6674, CVE-2014-2018

[AEMSecurity @AEMSecurity]

[+] Using Google dorks for unique subdomains?

Try this:

site:*-*-*.yourtarget.com
site:*-*.*.yourtarget.com
site:*.*.*.yourtarget.com

#bugbountytips
#bugbountytip
#AEMSecurity

[AEMSecurity @AEMSecurity]

[+] POC Video Microsoft Sharepoint Filter Bypass!

Looking back in time, I found an interesting filter bypass that resulted in a "Stored XSS" vulnerability affecting Microsoft Sharepoint 2013 in Office 365 (cloud)

https://t.co/HmnJuRvdVM

#AEMSecurity #bugbountytips #bugbounty

[@stuub @stuub_]

Helios, automated XSS auditing. I'm releasing this in very early stages but I'm pretty happy with a couple days' work, excited to see where it could go.

Feedback and testing is greatly appreciated!

Key Features Listed in the Github :)

#XSS #BugBounty

https://t.co/8fFjh7BW5g

[AEMSecurity @AEMSecurity]

[+] Dont ignore those out of scope domains!

Recently, I saw an application. This domain was listed as out of scope unfortunately..

More recon on target assets, I noticed very same application hosted on an IP owned by the same org
Result: 4 IDOR's, 4 SXSS's

#bugbountytips

[AEMSecurity @AEMSecurity]

[+] FIlter bypass techniques:

Sometimes you can do amazing things just by appending /? to bypass access control restrictions ;)

#AEMSecurity #FilterBypass #bugbountytips #bugbountytip

[AEMSecurity @AEMSecurity]

If you are looking for XSS and come across an input form lets say "description" ? instead of injecting your payload on the very first line, skip the first two i.e. press enter or something and then inject your payload on the next line instead.. #bugbountytips #XSS #AEMSecurity

[Ateeq Khan @OhTheITguy]

@Bugcrowd O_o

[AEMSecurity @AEMSecurity]

[+] Auth Bypass:
Find valid endpoints redirecting to login page.

Register new user, provide 1 in all input fields.

SUBMIT form, of course you're going to get an error, IGNORE and simply access endpoints you enumerated earlier...
#bugbountytips
#pentesting
#AEMSecurity

[AEMSecurity @AEMSecurity]

[+] Another awesome Adobe AEM Dispatcher filter bypass technique? oh okay

Hunting for JSON GET Servlet on /content.1.json however result = 404?

Try this:

/conten/.1.json
/conten/t.1.json
/content.tidy.1.json
/conten/.tidy.infinity.json

#AEMSecurity #bugbountytips #pentesting

[Ateeq Khan @OhTheITguy]

Adobe AEM dispatcher filter rules bypass triggered XSS on Linkedin... https://t.co/kxLyxe8Uir via @YouTube #AEMSecurity

[AEMSecurity @AEMSecurity]

Amazed to see CVE-2016-0956 Apache Sling POST Servlet vulnerability discovered back in 2014 still works!!!!!! #AEMSecurity #bugbountytips #bugbountytips

[AEMSecurity @AEMSecurity]

[+] #BugbountyTips

Fetch password hash via QueryBuilder Servlet?

#AEMSecurity #BugbountyTip #Bugbounty

[ႢႭႹႠ ႭႵႰႠႻႤ გოჩა ოქრაძე (Gocha Okradze) @GochaOqradze]

@AEMSecurity Yes it is high level. Subscibed 🤯
Editing is super. I like your intro then xss blow my mind.
Interesting fact was when you add
;.html and you got worked <h1> tag

[AEMSecurity @AEMSecurity]

[+] #bugbountytips

Dispatcher you are awesome!!

Apache Sling JSON GET Servlet bypass technique:

hxxps://targetAEM/node/........json <--- blocked???

Try:

hxxps://targetAEM/nod/.......json

;)

#AEMSecurity #bugbountytip

[AEMSecurity @AEMSecurity]

#bugbountytips #AEMSecurity

If you have confirmed an HTML injection on AEM Instance however XSS is limited because you are unable to execute document.domain or document.cookie???

Try (cookie) ;)

#bugbountytip

[reмо̷̷иѕec @remonsec]

Adobe AEM Security Web Series Part 1 by @AEMSecurity

https://t.co/kIB0FG3MTM
#bugbountytips

[Zin Min Phyo @zin_min_phyo]

I earn a €300 bounty on the Yogosha platform

AEM_Tips:
I analyzed the javascript code, I found this parameter, but I can't bypass of Content-Type
here is the template: https://t.co/vf1817y3E6

Ref: https://t.co/gtiXlW88Oq
Special thanks to @AEMSecurity

#BugBountyTips

[AEMSecurity @AEMSecurity]

[+] #bugbountytips

You really need to analyze logs manually via "Logger" when Using Burp Suite.

I confirmed 4 HTTP Request smuggling issues + 2 SSRF's and these issues were not flagged by Burp scanner so yup! see what I mean?

#AEMSecurity #bugbountytip

[AEMSecurity @AEMSecurity]

[+] Exclusive!

Thank you @salesforce

#bugbountytips #swag

[AEMSecurity @AEMSecurity]

#bugbounty

Have you ever faced this situation where you thought it was a "CRIT" however triager declares it as a "LOW"???

https://t.co/OTi8G1XZn1